01
Choose the right licensed service model
A company furnishing guards for compensation must assess applicable California PPO licensing requirements. Verify Astro's current BSIS license and assigned officer registrations and permits before service. Hospital-employed proprietary security is a different model with its own potential employer and officer requirements; BSIS's qualifying Proprietary Private Security Employer category is for the employer's own services, not subcontracting. A partnership does not transfer a PPO license or authorize a hospital or other company to operate under it.
02
Security operations—not clinical operations
An agreed management scope can cover security staffing plans, shift coordination, post orders, supervisor review, attendance checks, incident escalation and service-quality meetings. The hospital retains clinical decisions, patient care, hospital licensure, medical staffing and clinical policy. Identify the employer, reporting authority and insurance duties in writing; a management agreement does not automatically transfer hospital employees to Astro.
03
Healthcare workplace violence prevention
Cal/OSHA Title 8 § 3342 applies to specified healthcare facilities and operations. Covered employers have prevention-plan, training, incident-log and recordkeeping duties, with additional provisions for certain hospitals. Coordinate security post orders and reporting with the hospital's workplace violence prevention plan. Contracting security does not automatically transfer the hospital employer's legal responsibilities to Astro or establish compliance by itself.
04
Patient-centered access and response
Plan visitor verification, entrance coverage, authorized restricted-area access, parking observations, staff escorts and de-escalation support. Define the escalation chain for emergency departments and other high-stress areas with hospital leadership. Officers do not make clinical decisions, independently authorize patient restraint or replace emergency responders. Any restraint, detention, search or force-related duties require specific legal, clinical-policy and training review before inclusion.
05
Privacy and information handling
Limit access to patient information to what the approved role lawfully requires, and keep clinical records out of ordinary security inquiries and general activity reports. A security vendor is not automatically a HIPAA business associate merely by being onsite: the determination depends on its functions and access to protected health information. Review business-associate agreements, minimum-necessary rules where applicable, secure reporting, retention and access permissions with the hospital's privacy team.
06
Custom pricing and measurable oversight
Prepare a private proposal after reviewing entrances, risk, hours, officer credentials, required supervision, equipment and security-management duties. Agree on coverage checks, supervisor availability, incident-response contacts, review meetings and the process for approved additional hours. Do not assume around-the-clock onsite supervision unless the signed scope includes it. Armed coverage and specialist assignments require separate site, credential and policy review.
